PT-2026-23122 · Idc · Sfx2100 Satellite Receiver

Abdul Mhanni · Published 2026-03-05 · Updated 2026-03-11 · CVE-2026-29126

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:H/SI:H/SA:H/AU:N/R:U

Name of the Vulnerable Software and Affected Versions IDC SFX2100 Satellite Receiver (affected versions not specified)

Description A misconfiguration involving incorrect permission assignment of a world-writable file, specifically /etc/udhcpc/default.script, exists. This allows a local, unprivileged attacker to potentially execute arbitrary commands with root privileges. The issue stems from the modification of a root-owned, world-writable BusyBox udhcpc DHCP event script. This script is executed during DHCP lease events – obtaining, renewing, or losing a lease – leading to potential local privilege escalation and persistence.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

LPE

Incorrect Authorization

Incorrect Permission

Weakness Enumeration

CWE-863

CWE-732

Related Identifiers

CVE-2026-29126

Affected Products

Sfx2100 Satellite Receiver

References · 7

• 🔥 https://abdulmhsblog.com/posts/sfx2100-vulns · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-29126 · Security Note
• https://abdulmhsblog.com/posts/spfx-vulnrabilities · Note
• https://twitter.com/CVEnew/status/2030755420587827526 · Twitter Post
• https://t.me/cveNotify/155151 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2029454120487113124 · Twitter Post
• https://t.me/CVEtracker/46398 · Telegram Post